UK law in the era of global platforms: how does the Online Safety Act impact non-UK companies?

The OSA was introduced against a backdrop of technological advances that have enabled online platforms to distribute content on a global scale, linking users around the world in real time. Whilst this connectivity has brought undeniable benefits, it has also made it easier for harmful content to proliferate. To address these risks, the OSA establishes a regulatory framework that is designed to apply both to UK and non-UK based entities, recognising that content can travel far beyond the country in which it was created.

4chan’s refusal to cooperate with Ofcom, and its broader rejection of the OSA’s applicability to its  operations, raises critical questions about how global platforms interpret and respond to UK law. In this article, we explore which international companies may fall within the scope of the OSA and what this means in practice.

Ofcom's investigation into 4chan

4chan is an image-based bulletin website which allows users to post and interact on the platform anonymously. Although it reportedly has no assets or operations in the UK, its platform attracts a global user base. Because of these factors, its services fall within scope of the OSA.

Under the OSA, "user-to-user" services are required to assess the risks of illegal material on their platforms. In April 2025, Ofcom sent formal requests to 4chan asking for copies of its illegal content risk assessment. 4chan reportedly did not respond to these requests, triggering Ofcom to launch an investigation into whether 4chan was failing to comply with its OSA duties. In August 2025, the matter escalated when Ofcom issued a provisional notice of contravention regarding 4chan's failure to comply with the information requests. Public statements indicate that 4chan continues to reject compliance with Ofcom’s requests, maintaining that as a US-based entity, it is not bound by UK law. Ofcom's final decision is pending.

4chan has now initiated legal proceedings in the US federal courts seeking a declaration that Ofcom does not have the power to enforce the OSA in the US, and a permanent injunction prohibiting Ofcom from enforcing the OSA against 4chan. The outcome of this case could have important implications for UK-US relations in the sphere of online safety.

How does the OSA apply to non-UK based platforms?

The OSA applies to online companies providing user-to-user services or search services with "links with the UK", unless an exemption applies.  A service has "links with the UK" if one (or more) of the following applies:

1. any part of it has a significant number of UK users;
2. UK users are a target market for the service; or
3. the service is capable of being accessed by UK users and there is a material risk of significant harm to those users.  

The OSA therefore has the potential to capture a broad range of overseas entities, even where they have no intention of targeting UK-based users.

What does "significant number of users" mean?

The term "significant" is not defined in the OSA. Businesses therefore have some flexibility in adopting an appropriate methodology for calculating their user numbers, provided they can clearly explain the rationale behind their chosen method. UK users can be individuals or entities (e.g. organisations), although companies should only count those users who have actually engaged with the service, for example through submitting a search query, or posting or 'liking' content.

What does it mean to "target" UK users?

Ofcom has indicated that a service is likely to "target" a UK user base if it:

1. is designed for UK users;
2. is promoted or marketed towards UK users;
3. generates revenue from UK users (directly or indirectly, e.g. via subscriptions or advertising);
4. includes functionalities or content that is tailored for UK users; or
5. has a UK domain or provides UK contact details.

What is the practical impact for non-UK companies?

Non-UK companies that fall within the scope of the OSA are required to comply with regulatory obligations in relation to any aspect of their service that is accessible to UK-based users.

Depending on the design, function or purpose of the platform, a company may make adjustments to elements of the platform that are accessibly by UK users, or bring the whole platform in line with UK standards. Alternatively, a company may block UK-based users from its platform – an approach adopted by various companies following the introduction of the GDPR which similarly has extra-territorial application.  Regardless of its operations, an in-scope company must cooperate with Ofcom, including for example by providing requested information and attending interviews with the regulator.

If a company wishes to challenge the applicability of the OSA to its services, it may have grounds to challenge Ofcom's decision by way of a judicial review claim. For further details, see our article Challenging Ofcom Decisions under the Online Safety Act.

What are the implications of non-compliance?

Failure to comply with obligations under the OSA may expose companies to a range of enforcement measures by Ofcom, including substantial financial penalties based on global turnover.

Such measures may be simple for Ofcom to enforce against a company's UK-based assets. However, the issue of whether Ofcom is able to enforce the OSA in other jurisdictions is more complex. Cross-border enforcement will largely depend on the private international law of the relevant foreign jurisdiction, including the existence of reciprocal arrangements for the recognition and enforcement of judgments. In practice, and as brought to bear by 4chan's legal claims against Ofcom in the US, diplomatic engagement between governments is also likely to play a significant role in supporting Ofcom’s enforcement efforts overseas.

If direct enforcement is unsuccessful, Ofcom has the power to disrupt a platform’s operations by targeting associated third parties. It can apply to the English courts for “business disruption measures”, which compel third parties either to withdraw services from, or block access to, a non-compliant platform. This could include, for example, preventing third companies from providing ad servers or payment processing services, requiring an App store to remove a certain app, or requiring an internet service provider to block users' access to the non-compliant service.  Notably, these third parties do not need to be regulated by Ofcom.

Beyond regulatory measures, non-compliant companies may face reputational damage, particularly if they are perceived as enabling or tolerating harmful content on their platforms. This perception can have wider commercial consequences, potentially deterring third parties from entering into transactions or partnerships with non-compliant entities, even where those third parties are based outside of the UK.

If you would like to discuss any of the issues raised in this blog, please get in touch with Regulatory Partner Oliver Carlyon and Senior Associate Jen Qosja.

The content of this blog does not constitute legal advice and is provided for general information purposes only. Specific legal advice should be sought before taking any actions based on the content of this blog.